HIPAA Compliance Complaints, Data Breaches Increase
The U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) has issued its annual reports to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance and Breaches of Unsecured Protected Health Information.
Overall, the OCR received 17% more HIPAA complaints from 2018 to 2022, while large breaches increased 107% over the same time period.
HIPAA Compliance Complaints Lead to Costly Penalties
The 2022 Report to Congress on HIPAA identifies the number of complaints received, the method by which those complaints were resolved, the number of compliance reviews initiated by OCR, and the outcome of each review. Some highlights include:
- OCR received 30,435 new complaints alleging violations of the HIPAA Rules
- OCR resolved 32,250 complaints alleging violations of the HIPAA Rules
- OCR resolved 17 complaint investigations with Resolution Agreements and Corrective Action Plans (RA/CAPs) and monetary settlements totaling $802,500, and one complaint investigation with a civil money penalty in the amount of $100,000
- OCR completed 846 compliance reviews and required subject entities to take corrective action or pay a civil money penalty in 80% (674) of these investigations. Three compliance reviews were resolved with RA/CAPs and monetary payments totaling $2,425,640.
Hacking Continues to Top Reported Breaches
The 2022 Report to Congress on Breaches identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to the Secretary of HHS during 2022 and the actions taken in response to those breaches.
As in previous years, hacking/IT incidents remain the largest category of breaches occurring in 2022, affecting 500 or more individuals, comprising 77% of the reported breaches. Network servers continued as the largest category by location for breaches involving 500 or more individuals at 58% of reported large breaches.
This highlights the continued need for regulated entities to improve compliance with the HIPAA Security Rule requirements, including:
- risk analysis and risk management;
- information system activity review;
- audit controls;
- response and reporting; and
- person or entity authentication.
Data Breaches Show Need for Improved Compliance
“OCR’s Reports to Congress provide useful information for everyone on trends in HIPAA complaints and breach reporting,” said OCR Director Melanie Fontes Rainer. “Our health care systems should take note of these trends and address potential HIPAA compliance issues before they experience a breach or receive notice of an OCR investigation.”
Need help planning what steps to take to keep your data secure and private? Our team of experts stays up-to-date with the latest changes in regulations to ensure that your policies and procedures remain compliant at all times. We’re here for you. Contact the experts at PrivaPlan today at info@privaplan.com or 877-218-7707.
